Typosquatting attack
It seems that all the security measures they have been working on in the Python package repository PyPI (Python Package Index) have not been very effective, since even though they forced users to use two-factor authentication and implemented security measures to prevent the introduction of malicious packages as much as possible, they still continue to have a large number of problems with it.
And one of the big problems that plagues NPM is the blatant loading of malicious packages, which is a problem that it has had in recent years and has not been able to eradicate and the reason for mentioning this is that this situation is the same that PyPi is experiencing, although to a lesser extent, since attempts have been made to implement various security filters, and I mention trying because malicious packages continue to appear.
The reason for mentioning this is that a temporary ban was recently imposed on new user registrations and the creation of new projects on the Python package repository PyPI due to an ongoing automated attack that has led to the mass download of malicious packages. This measure was taken after 566 packages containing malicious code, which mimicked the style of 16 popular Python libraries , were uploaded to the repository on March 26 and 27.
The names of these malicious packages are formed using typosquatting techniques, which involve assigning similar names with only minor differences in individual characters. For example, names like "temsorflow" instead of "tensorflow," "requyests" instead of "requests," and "asyincio" instead of "asyncio" are used. These attacks exploit user distraction, as users may make typos when searching for or following links in forums and chat rooms where attackers leave deceptive instructions.
Malicious packages are based on code from legitimate libraries and include changes that install malware on the system. This malware searches for and sends sensitive data and files, such as passwords, access keys, cryptocurrency wallets, tokens, and session cookies. The malicious code is embedded in the setup.py file, which runs during package installation, and when activated, downloads malicious components from an external server.
This automated typosquat attack was carried out over a few hours in a few quick bursts, saw the release of over 500 packages, and targeted 16 popular PyPI packages. While PyPI's quick and forceful response certainly helped mitigate the consequences of this attack, it is worth noting that not all ecosystems are as fast and effective in dealing with such an attack.
The attack on the PyPI repository was quite extensive and affected several popular Python libraries . The attackers managed to download malicious variants of packages such as TensorFlow, BeautifulSoup, PyGame, SimpleJson, Matplotlib, PyTorch, CustomTKInter, Selenium, Dramaturgo, Asincio, and Request. In addition, isolated cases of forged libraries such as py-cord, colorama, capmonstercloudclient, pillow, and bip-utils were identified.
Regarding the attack on the Top.gg community, the attacker compromised the GitHub account of one of the developers, allowing him to steal browser cookies and make malicious changes.
Three malicious packages were added to the PyPI repository and fake domains were registered to distribute dependencies on malicious packages. Through a hacked account, a change was made to the GitHub repository of the Top.gg project, where a requirements.txt file was added containing a link to a malicious clone of the “colorama” package hosted on a fake domain. The goal was to trick developers into downloading the malicious version of the package, as the fake domain resembled the legitimate domain used to download packages from PyPI.
These attacks highlight the importance of security in package repositories and the need for users and developers to be alert to possible attempts to compromise security and download malware.
If you are interested in learning more, you can find the details at the following link.